Foundation Models Are Restructuring the Robotic Control Loop

The same capabilities that make foundation models useful also expand the set of inputs that a robot may treat as decision-relevant. Conventional robots typically consume structured goals, sensor streams, and fixed APIs. Foundation-model-powered robots may additionally read natural-language instructions, scene text, retrieved web or RAG content, interaction history, long-term memory, messages from other agents, and heterogeneous multimodal observations. Once such information becomes part of the control loop, data that would ordinarily be considered “semantic content” can acquire physical authority. Consequently, an adversary may not need to compromise a motor controller, ROS node, or actuator directly; manipulating information trusted by the model can be sufficient to induce the system to generate an adversary-desired behavior on its own.

Why Embodied-Agent Security Differs from Text-Only LLM Security

Embodied systems also introduce risks that are absent or much less prominent in text agents. First, environmental and sensor attacks must satisfy physical realizability constraints involving view angle, distance, occlusion, lighting, and dynamics. Second, continuous control creates temporal accumulation: a small error at one step may alter the next observation and amplify over a long horizon. Third, mistakes can have irreversible physical consequences such as collision, dropping objects, or unsafe contact. Fourth, runtime defenses operate under strict latency budgets. Fifth, heterogeneous representation changes—from pixels to semantic state, from language to plans, and from plans to executable actions—create multiple privilege transitions. Embodied AI security is therefore better viewed as cyber–physical agent security rather than a simple union of LLM jailbreaks, adversarial vision, and traditional robot cybersecurity.

What Existing Surveys Cover, and What Remains Missing

However, when the goal is to answer “where, exactly, is a particular embodied attack entering the system?”, classifications based primarily on mechanisms or model types can remain ambiguous. A backdoor may be implanted during training but triggered by language, a physical object, a state pattern, or an action chunk. Prompt injection may come from the current user, from a screen in the environment, from a RAG document, or from another robot. An adversarial patch may primarily corrupt perception, but it may also be optimized to hijack chain-of-thought or continuous action generation. If labels such as “backdoor”, “prompt injection”, or “patch” are treated as top-level attack surfaces, the distinction between how an attack is implemented and where it first crosses a trust boundary is lost.

Our Perspective, Research Questions, and Contributions

We study five research questions:

• RQ1: How should a foundation-model-powered embodied agent be represented as a unified closed-loop system, and where should its trust boundaries be drawn?
• RQ2: Which trust boundaries are most frequently targeted by current attacks, and how do attack mechanisms propagate across layers into physical execution?
• RQ3: Where are existing defenses deployed, and does defense coverage match the distribution of exposed attack surfaces?
• RQ4: Which metrics are currently used at the model, planning, action, and physical layers, and what closed-loop metrics are still missing?
• RQ5: As long-term memory, world models, end-to-end VLAs, multi-robot collaboration, and cloud-edge integration become common, which security problems should receive priority?

Our contributions are fourfold. First, we model embodied agents as a closed information and control loop extending from development and supply chain to physical execution, explicitly distinguishing attack entry, propagation, and consequence. Second, we introduce a five-layer, twelve-surface taxonomy and decision rules that make mechanisms such as jailbreak, backdoor, poisoning, and sensor spoofing orthogonal to system entry points. Third, we provide a quantitative landscape analysis based on 58 attack records and 61 defense records, exposing asymmetries between attack and defense attention. Fourth, we connect taxonomy to evaluation and deployment, and derive a research agenda around closed-loop attack success, long-horizon causal propagation, physical realizability, provenance, and compositional defense.

Scope and Study Population

We focus on embodied systems in which an LLM, VLM, VLA, world model, or world-action model participates materially in perception, state construction, task planning, policy generation, tool use, or action control. The scope includes hierarchical LLM-planner-plus-skill-executor architectures, VLM-based navigation, end-to-end VLA manipulation, LLM-integrated mobile robots, multi-robot LLM coordination, and the ROS/ROS2, networking, and cloud-model infrastructure that directly couples to these systems.

To avoid indiscriminately including all conventional robot-security work, we use three inclusion tiers:

• A–Core: Studies directly investigating attacks or defenses involving LLM, VLM, VLA, or WAM components in an embodied control loop.
• B–Adjacent: Studies primarily addressing VLA, autonomous driving, vision–language navigation, or mechanisms directly transferable to the target systems.
• C–System Extension: Studies that may not center on a foundation model but directly cover ROS, networking, multi-robot, or supply-chain boundaries forming part of the deployed system.

This design keeps the survey focused while preserving infrastructure risks that would otherwise be artificially separated from foundation-model-powered robotics.

Corpus and Temporal Boundary

The corpus used in this version contains 58 attack records and 61 defense records through August 15, 2026. The attack corpus contains 50 A–Core, 3 B–Adjacent, and 5 C–System Extension records; the defense corpus contains 36 A–Core, 22 B–Adjacent, and 3 C–System Extension records. We use the foundation-model-powered robot SoK and VLA safety survey as major seed sources, cross-check them against LLM-agent security, LLM-controlled robotics risk surveys, and the world-model security survey, and include newer work from mid-2026.

The term “near-exhaustive” should not be interpreted as a literal guarantee of every paper in a rapidly changing area. Many 2026 studies are first released as arXiv preprints, and venue assignments or experimental details may change. We therefore treat the corpus as a dynamic snapshot rather than a permanently closed bibliography.

Coding Fields and the Multi-Label Principle

Each attack record is coded with at least year, publication status, model type, inclusion tier, lifecycle stage, attack mechanism, attack-surface code, primary target module, attacker access, security objective, physical or real-world validation, evaluation platform, method summary, and main result. Defense records additionally capture defense stage, defense mechanism, covered surfaces, target module, required access, defense type, and validation environment.

Attack surfaces may be multi-label, but we require a distinction between the primary entry surface and propagation or target surfaces. If a malicious user prompt changes task planning and eventually produces a dangerous API call, AS02 is the primary entry, while AS08 and AS09 are downstream targets. If the attacker directly modifies a robot skill or action token, AS09 becomes the primary surface. For backdoors, malicious capability implanted during training is coded as AS01 even if deployment-time triggers are linguistic or visual. These rules prevent the final physical error from being indiscriminately relabeled as AS12.

Six Coding Dimensions

We use six complementary dimensions when deciding the primary surface:

• Representation type: Distinguish natural-language tasks, raw image, audio, or LiDAR, structured state, chain-of-thought or hidden state, task plans, code, JSON, or action tokens, and ROS messages.
• Lifecycle stage: Distinguish development-time threats involving training, fine-tuning, and model distribution from deployment-time prompt, sensor, state, and network attacks.
• Source and authority: Determine whether information originates from an authenticated user, the environment, RAG or memory, a tool, a cloud service, or another robot.
• Propagation scope: Distinguish intra-robot compromise from robot-to-robot, shared-memory, and fleet-level propagation.
• Security property: Treat integrity, availability, confidentiality or privacy, and physical safety as attack objectives rather than attack surfaces.

Methodological Limitations

Three limitations are unavoidable. First, some recent papers remain preprints and their venue status or experimental details may change. Second, multi-label coding necessarily involves judgment, especially when end-to-end VLAs tightly couple perception, reasoning, and action generation. Third, paper counts measure research attention rather than real-world attack probability; a heavily studied surface is not automatically more dangerous in deployment. The quantitative analysis should therefore be interpreted as a map of research density and attack–defense imbalance, not as an empirical incident-frequency estimate.

Entry, Propagation, Target, and Consequence

For an attack, we use a tuple describing its entry surface, propagation path, target, and consequence.

The tuple represents the attack’s first compromised boundary, subsequent propagation or target surfaces, and resulting consequence.

This distinction prevents classification by final outcome. A robot executing a dangerous action because of prompt injection does not make AS12 the primary surface. AS12 is primary only when the attacker directly manipulates trajectories, actuator commands, halt or freeze logic, or an availability boundary. Likewise, a malicious prompt that causes an incorrect chain of thought does not automatically become an AS07 attack; AS07 is primary when reasoning or an internal representation itself is directly targeted.

Adversary Capabilities and Access Models

The literature spans black-box to white-box adversaries. A black-box adversary can provide language, manipulate environmental objects, or query outputs. A gray-box adversary may know architecture, skill interfaces, or partial state without changing all parameters. A white-box adversary can access model weights, gradients, training data, or internal representations. A system-level adversary may additionally reach ROS topics, network links, credentials, cloud APIs, or inter-robot messages. Physical proximity is another important dimension because patches, printed prompts, 3D textures, optical signals, and acoustic injection depend on deployment conditions.

Security, Safety, and Privacy

We use security for protection against intentional adversaries targeting integrity, availability, confidentiality or privacy, or physical safety, while safety also includes failures caused by benign perception error, planning mistakes, dynamics uncertainty, or control instability. The final physical consequence can be identical even when causality differs. A naturally misperceived obstacle is a safety failure; an adversarial patch deliberately causing the same miss is a security-induced safety failure. VLALeaks further demonstrates that embodied models may expose membership information and other privacy properties. A mature framework should therefore record adversary, first boundary, security objective, and physical consequence separately.

Why Attack Surfaces and Attack Mechanisms Must Be Orthogonal

Attack mechanisms describe how a compromise is achieved; attack surfaces describe where it first enters. A backdoor can be implanted in training data, a perception model, a state representation, or an action generator. AS05 can host adversarial patches, sensor spoofing, visual triggers, or deployment-time backdoor triggers. We therefore avoid labels such as “jailbreak surface” or “backdoor surface” and instead use mechanism as a second coding dimension.

The separation also handles composite attacks. TRAP uses a physical adversarial patch but targets VLA chain-of-thought reasoning; AS05 can be recorded as the input surface and AS07 as a critical internal target. RIPA spans OCR, audio or speech-to-text, and LiDAR or state-vector channels, with the primary surface determined by whether the earliest corruption is a raw sensor or a structured state. When Prompts Control Robots shows that AS04 environmental or indirect injection and AS11 cross-robot propagation may occur in the same attack chain.

Attack Research: From the First Compromised Boundary to Physical Consequences

This section reviews the attack literature using the twelve surfaces. For each surface we ask: what representation is first controlled by the adversary; how representative mechanisms operate; how effects propagate into plans and actions; and what major limitations remain.

AS01: Model, Data, and Supply-Chain Attacks

AS01 covers training data, fine-tuning examples, LoRA or adapters, checkpoints, third-party perception or policy models, and dependent components. When malicious capability is encoded before deployment, the primary surface remains AS01 even if the runtime trigger arrives through language, vision, or state. This separation between implantation surface and trigger carrier prevents every visual-trigger backdoor from being misclassified as a perception attack.

Two trends are visible. First, embodied backdoors are moving from conspicuous linguistic triggers and obviously unsafe outputs toward environmental conditions, physical-object triggers, and subtle action drift. Such attacks are substantially harder to catch with harmful-text filters. Second, end-to-end VLAs couple perception and action generation within one model, allowing training-time objectives to embed malicious behavior directly in continuous-control distributions without ever producing a human-auditable language plan.

The central defensive challenge is that clean-task performance does not establish trustworthiness. High-quality backdoors are explicitly optimized to preserve benign success. Standard benchmarks and a small number of safety prompts are therefore insufficient. Stronger guarantees require data provenance, weight or adapter integrity, model-differential analysis, trigger search, and persistence testing under downstream fine-tuning.

AS02: User Instruction and Natural-Language Control

AS02 is the authorized user-task channel. An adversary changes the system’s intended task through malicious natural language, adversarial suffixes, jailbreaks, direct prompt injection, or speech commands. Its defining distinction from AS03 and AS04 is that the malicious text arrives through the interface explicitly granted authority to specify the current task.

These studies expose at least three success conditions: the model accepts the malicious intent, the planner produces a goal-consistent plan, and the executor can realize it. Conventional jailbreak success rate usually captures only the first condition.

Frequently Asked Questions

What makes security for embodied agents different from text-only LLM security? Embodied agents face physical realizability constraints, temporal error accumulation, irreversible consequences, strict latency budgets, and multiple representation and privilege transitions.

How does the taxonomy distinguish attack surfaces from attack mechanisms? Attack surfaces identify where an attack first enters the system, while mechanisms describe how the compromise is achieved.

How many attack and defense records are included in the corpus? The corpus contains 58 attack records and 61 defense records through August 15, 2026.

Why should the final physical consequence not determine the primary attack surface? The primary surface is the first trust boundary directly controlled by the adversary, while the physical consequence may occur downstream.